Analytics BIOC Informational
✕

Uncommon attempt at discovering a sensitive file

A process made an uncommon attempt to access a file that may contain sensitive information.

Module:
Platform Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: File and Directory Discovery (T1083) Process Discovery (T1057) System Service Discovery (T1007) System Network Configuration Discovery (T1016) System Owner/User Discovery (T1033) System Network Connections Discovery (T1049) System Information Discovery (T1082)
Detector tags: EDR Discovery Analytics
Attacker's goals:

Attackers may attempt to access sensitive files to steal credentials, perform reconnaissance on system configurations and users, and find pathways for lateral movement.

Investigative actions:

Review the event's context - examine the process, its command line, and its origin to gain a comprehensive understanding of the anomalous access.* Assess the behavior's legitimacy: Given that this is an uncommon event, determine if this file access is an expected and authorized behavior for the actor process.

Test period:
N/A (single event)
Deduplication:
1 Day
8 variations:
  • Uncommon attempt at discovering /etc/hosts Informational
  • Uncommon attempt at discovering a sensitive file by a security testing tool Medium (parent: Informational)
  • Uncommon attempt at discovering a sensitive file by a potentially known credential dumper or enumeration script Medium (parent: Informational)
  • Uncommon attempt at discovering a sensitive file by a potential Webshell Low (parent: Informational)
  • Uncommon attempt at discovering a sensitive file by a script that was executed by a rare causality Low (parent: Informational)
  • Uncommon attempt at discovering a sensitive file from temporary or world writable directories Low (parent: Informational)
  • Uncommon attempt at discovering a sensitive file by a rare process that was executed by cron Low (parent: Informational)
  • Uncommon attempt at discovering a sensitive file by a non-GTFOBIN process Low (parent: Informational)